# Install-pair curation contract

The operator approved a pair set on 2026-08-21, so this directory now ships
`manifest.json` and its `assets/`. The set was chosen from the public
evaluation corpus and rendered for sign-off by
`tools/pair_approval_sheet.py`; `tools/build_onboarding_manifest.py` turns
that selection into these bytes and refuses to leave a manifest on disk that
does not load through the product's own loader.

Two rules the shipped set obeys, and `tests/test_shipped_manifest.py`
enforces. **The bytes that ship are the bytes the metrics describe** - frames
are copied verbatim from the corpus derivation, never re-encoded or resized,
because re-encoding moves the measurements and the manifest would then
describe pixels nobody sees. **One side of every pair is the untouched
frame** - two derived variants can isolate an axis on paper and still be a
dishonest question, as an under-exposed frame against a tilted one did: `tilt`
was unmeasurable on both sides, so a rotation anyone can see counted for
nothing, and a person rejecting the tilted frame would have been recorded as
having a view about contrast.

The doctor RAW sample is still absent and is still an outside input.

`manifest.json` must validate against
`manifest.schema.json` and every asset must be stored at
`assets/<sha256-of-file-bytes>` with no extension. Array order is the display
order and `position` must be the consecutive 1-based form of that order.
`genres` must be sorted and unique. Both sides carry a complete immutable
normalised-metric map, and those metrics must isolate the declared `axis`
under Cherry's published calibration thresholds. The two hashes in a pair
must differ and no pair may be repeated. Each asset must decode as the
declared JPEG, PNG or WebP media type; matching a hash alone is insufficient.
Schema version and pair position are strict JSON integers, never booleans or
numerically equal floats.

`licence` and `source_url` are required provenance for each file. The loader
validates them and the file hashes, but it never fetches a URL. Provenance is
not returned by the app endpoints and never enters a journal or export.
Surfaces request assets only by SHA-256.

The eventual `doctor-sample.dng` is a separate outside-input artifact. It
must have its own verified licence row before it is committed.
